CVE-2023-4612

apereo central authentication service

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2023-4612

Katalog CVE

CVSS 9.8 · Critical EPSS 0,94%

Kerentanan Authentication Bypass by Assumed-Immutable Data pada apereo central authentication service. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.This issue affects CAS: through 7.0.0-RC7. It is unknown whether in new versions the issue will be fixed. For the date of publication there is no patch, and the vendor does not treat it as a vulnerability.

Rincian

Terbit di NVD
9 November 2023
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-302: Authentication Bypass by Assumed-Immutable Data
CWE-287: Improper Authentication
EPSS (30 hari)
0,94% peluang dieksploitasi; lebih tinggi dari 59,9% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
apereo central authentication service Semua versi sebelum 7.0.0
apereo central authentication service Versi 7.0.0 rc1
apereo central authentication service Versi 7.0.0 rc2
apereo central authentication service Versi 7.0.0 rc3
apereo central authentication service Versi 7.0.0 rc4
apereo central authentication service Versi 7.0.0 rc5
apereo central authentication service Versi 7.0.0 rc6
apereo central authentication service Versi 7.0.0 rc7

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.